AI enablement and risk support
AI use at Waterloo is evaluated through a coordinated process involving Information Systems & Technology (IST), Legal & Immigration Services (LIS), departments, and Information Stewards. Together, these groups assess risks, ensure compliance, and provide guidance on the adoption of AI tools.
When University data is involved, departments and Information Stewards determine whether a tool or use case is appropriate, supported, or requires additional safeguards. The level of review depends on the data classification and the nature of the intended use. IST and LIS contribute to this evaluation by conducting risk and security assessments and providing privacy and contractual guidance.
Because AI use touches multiple governance areas—including data classification, intellectual property, privacy, security, and procurement—these considerations should be reviewed together when deciding whether and how an AI tool may be used with University data.
The below review process ensures that any AI tool used with University data is assessed for security, privacy, and contractual risks, whether the tool is standalone, embedded, or part of an AI-enabled system.
Initiation and scoping
Define the intended use of the tool, including:
- The data classification involved (Policy 46)
- Purpose and business or academic needs
- User groups and access roles
- Data storage, processing locations, and residency
Engage the appropriate Information Steward early to confirm data classification and assess whether the proposed use is appropriate.
Information Risk Assessment and Privacy Assessment (IRA/PIA)
Submit an intake request for an Information Risk Assessment (IRA) / Privacy Impact Assessment (PIA). The form will be submitted to IST's Information Security Services (ISS) and Legal & Immigration Services (LIS). These assessments evaluate:
- Security controls, threat exposure, and vendor practices
- Data retention, deletion, and subcontractor arrangements
- Privacy risks, including how data is used for training or analytics
- Compliance with institutional, legal, and contractual obligations
A PIA is required whenever personal or identifiable information is involved.
Contracting and procurement
If University data are used, Procurement & Contract Services will negotiate and establish a contract that includes:
- Appropriate data protection and privacy terms
- Security and compliance obligations
- Restrictions on data use, training, and storage
Visit the Procurement & Contract Services site to learn more.
Approval and onboarding
Once required assessments and contracting steps are complete:
- If the use case is limited, ISS and LIS will provide a risk assessment, and the requesting unit will determine approval or provide direction for limited use.
- If this is an enterprise-level initiation, IST will provide guidance and documentation on their website.
- Configuration and onboarding are completed to ensure secure use.
Learn more about the IRA/PIA processes.
Ongoing review and revalidation
Approved tools are reviewed periodically to ensure continued compliance. Revalidation occurs:
- Every five years or upon contract renewal
- When major vendor, feature, or data-handling changes occur
Tools may be reclassified or restricted if risk profiles change.